WO2009103364A1 - Method for the access-related or communication-related random encryption and decryption of data - Google Patents

Abstract

The invention relates to a method for encrypting and decrypting data of any type, the data being encrypted or decrypted with a random key to secure the integrity and/or authenticity of the data and/or to keep the data contents secret. At least one permutation date, a key control date and a random number are generated at the location of encryption. Random keys are determined from at least one separate random reference date and a random number. Plain text data are bit-permuted depending on the permutation data and the random keys and are encrypted and/or packet-permuted. The permutation data, key data and random data are added to the encrypted data in the form of relative data. The data added are used at the location of encryption to determine all data required for decryption and the encrypted data are decrypted.

Description

 Method for access and communication-related randomization and decryption of data

The present invention relates to a method for encrypting and decrypting data of all kinds, in which the data is encrypted and decrypted to secure its integrity and / or authenticity and to keep the contents of the data confidential with a random key.

Are known symmetric and asymmetric encryption and Entschlüs ^¬ selungsverfahren. Symmetric encryption methods, also called secret-key methods, work with keys that are known at the location of the encryption and at the location of the decryption. The symmetric methods include the cryptographic methods DES, triple-DES and AES. In the DES method, each 64-bit long plaintext blocks are subjected to a key-independent input permutation. Each permuted 64-bit plaintext block is then split into a left and right 32-bit block. A function is applied to the left 32-bit block, the result of which is exclusive or linked to the right 32-bit block. The result of this link becomes the new 32-bit block. The former left 32-bit block becomes the right 32-bit block. After 16 such rounds, the two 32-bit blocks are merged and subjected to a re-permutation. The function used in the DES method works on each round with a left 32-bit block that is first permuted and expanded to 48-bits. He then ^¬ follows an exclusive OR operation with a 48-bit long partial keys. The 48-bit block is divided into 8 blocks of 6 bit, which are transformed via substitution boxes 8 in eight 4-bit Ausga ^¬ review. The eight output values represent the 32-bit output value of the DES function.

The DES method generates from a 56-bit key Permutation and shift operations the subkeys required for the 16 rounds. Triple DES is based on the more ^¬ multiple use of DES algorithm. The Rijndael AES method is a block cipher like the DES. Like almost all block cipher Rijndael, the AES encrypted data in multiple iden ^¬ table running laps, another part is key in each round are used.

Asymmetric encryption, also known as public key cryptography, is based on a public key and a first function for encryption and on a private key and a second function for decryption. Both functions are in a defined relationship to each other.

The known methods above suffer from the key distribution problem. Every P2P communication requires the pre-exchange of a key.

From DE 101 04 307 Al a method and an arrangement for data encryption is known in which the key exchange problem is solved by the key transfer in relative form. Plain text data is encrypted in data encryption modules with a random key. In data braid modules, additional information is interlaced in the data. The encrypted and braided data is then mixed via bit byte permutation modules and packet permutation modules. To ^{¬ case} key and other information is transmitted in relative form from the place of encryption to the place of decryption. Random key and the permutation data are generated in random number generators of the transmitter. To generate true random numbers, this solution is disadvantageous. Another disadvantage of this solution is the high complexity of the bit byte and packet permutation.

The method according to the invention belongs to the symmetrical method. The object of the invention is to provide a method that clear data encrypts with each new encryption with in place, immediately before encryption newly generated random key, the decryption of the cipher data only for the authorized access independent of the location of the encryption and the key data Generates random data from multiple independent random number generators.

According to the invention the object is achieved by the teaching presented in the claims. In the following the invention is explained in more detail with reference ex ^¬ emplarisch of Figures 1 to. 4

FIG. 1 shows by way of example a unit (1.0) for implementing the method according to the invention. The unit (1.0) contains a communication-executing module (1.1), an encrypting and / or decrypting module (1.2), Ethernet interfaces (1.3), (1.4), (1.5) and (1.6), the switch (1.7 ), (1.8). The Mo ^¬ dul (1.1), embedded PC 1 includes at least a serial In ^¬ terface (1.9), the Ethernet interfaces (1.10), (1.11) and the ports (1.14), (1.15). The module (1.2), Embedded PC2, comprises at least the ports (1.14), (1.15), a biometric ^sensor (1.16) and a serial interface (1.17). The module (1.2) switches the switch (1.7) via the port (1.12) and the switch (1.8) via the port (1.13). The unit (1.0) is connected to the Internet via the Ethernet interface (1.3). To implement redundant networks, the Ethernet interface (1.4) is available. The Ethernet interface (1.5) is connected to egg ^¬ nem not shown home PC. The unit (1.0) is connected to a security intranet via the Ethernet interface (1.6). The modules (1.1) and (1.2) of the unit (1.0) are connected by their separate ports (1.14) and (1.15) mitein ^¬ other. Via the separate port (1.14) and / or the separate port (1.15), the module (1.1) provides the module (1.2) with the encrypted and / or unencrypted data. Via the separate port (1.15) and / or the separate port (1.14), the module (1.2) provides the decrypted and / or encrypted data for the module (1.1). In the module (1.2) at least one random reference date is unmanipulable and secretly stored for randomly predetermined time periods. For authentication and authentication, the module (1.2) is connected to a card device, not shown. A person authenticates himself by z. B. her fingerprint in connection with her person assigned, not shown security card. The module (1.2) authenticates the personzugeord ^¬ designated security card.

Figure 2 shows a first embodiment of the erfindungsge ^¬ MAESSEN method. Shown are a permutation date (2.1), a separate random reference date (2.2), a random number (2.3), another permutation date (2.4), a PI permutation module (2.5), a packet permutation date (2.6), a re-packet permu date (2.7), a re-permutation date (2.8), a random key date (2.9), exclusive or shortcuts (2.10), (2.14), switch (S ₁ , S _2B , S _2P , S ₃ ), memory blocks ( 2.12), (2.15), (2.17), (2.19), permutation and re-permutation modules (2.13), (2.16), (2.18), plain data (2.11) and cipher editors (2.20). Encryption and decryption take place in the two stages shown (2.21) and (2.22). Here, stage (2.21) identifies bit-related operations and stage (2.22) packet-related operations.

The separate random reference data (2.2) is read from the non Darge ^¬ put in force for a time range random reference data through the locked and decrypting module (1.2). The information about the location of the extraction of the separate random reference date, the permutation date (2.1), the random number (2.3) and the permutation date (2.4) are generated at the encryption location in the module (1.2) with a random generator of the module (1.2), not shown. The permutation date (2.1) contains eight 16-byte partial permutation data. Each byte of 128 bytes indicates the location of a bit in the permutated or non-permuted 128-bit block (B-bit block). The position of the byte in the permutation data (2.1) indicates the location of a bit in the non-permuted or in the permutated 128-bit long Block. The generation of the values of a permutation byte (PBj) preferably takes place by random draws of numbers from a sequence of numbers 0 to 127. Each draw may be a valid draw or invalid draw. A draw of a number is valid if and only if the drawn number value does not match the place index j of the permutation byte PBj in the permutation date

PI = {PB0, PB127}. If the drawing is valid, the drawn one will be drawn

Numerical value taken at the location of the location index of the permutation byte in the permutation date PI. If an invalid drawing the drawn number equal to the value of j Ortindex Permuta ^¬ tion bytes PBj is. He will then be returned before the next draw of the sequence.

The permutation date (2.4) has a word width of 24 bits. Three bits each characterize the position of a partial permutation date in the packet permutation date (2.6). The value of three bits indicates the location of a Teilpermutationsdatums in the parcel permu ^¬ tationsdatum (2.6) or a Teilpermutationsdatums in permu ^¬ tationsdatum (2.1). The location of three bits in the 24 bit long permutation (2.4) denotes the location of a Teilpermuta ^¬ tion datums in the permutation (2.4) or Teilpermutationsda ^¬ tums in the parcel permutation (2.6). The three bits are carried out analogously to the number generation described in the previous section.

The package permutation date (2.6) therefore consists of 128

Byte. Each byte of the 128 bytes of the packet permutation date

(2.6) indicates the location of an M-bit packet in the permuted or non-permuted N-byte block. The location of the byte in the packet permutation data (2.6) indicates the location of an M-bit packet in the non-permuted or permuted N-byte block.

For the chosen embodiment, B = 128, M = 64 and N = 1024.

The 128-bit random key (2.9) is taken from the separate 128-bit random reference data (2.2) and the 128-bit random number (2.3) determined by exclusive-OR operation (2.10).

Clay data (2.11) is decomposed into 128-bit blocks (2.12). Everyone

128Bit block (2.12) is used with the permutation and re-

Permutation module (2.13) using the permutation date

(2.1) permuted bitwise. After the bitpermutation has taken place, the first bitpermutated block of the plain data is exclusively-or-linked with the 128-bit random key (2.9). After encryption of the first bitpermutierten block switches the switch (S ₁ ) using the switching date US ₂ in the position 2, so that each further bitpermutierte block used as ^{¬ case} key the encrypted, bitpermutierten clear data of the previous block.

The encrypted bit-permissible clear data blocks are repermutated bit by bit in the re / permutation module (2.16) and combined into 1024 byte blocks (2.17). Each 64-bit packet of the 1024-byte block (2.17) is permuted packet by packet in the M-bit packet (re) permutation module (2.18) depending on the packet permeation date (2.6). All permutated 1024-byte blocks (2.19) then give the cipher franchises (2.20). The decisions ^¬ development of the cipher data (2.20) is carried out in the reverse order of encryption. Instead of the permutations, re-permutations occur and permutations occur instead of the re-permutations. The switches (S _2B , S _2P ) are then in position 2 and switch (S ₃ ) in position 1. The changeover is made with the date US ₁ .

Figure 3 shows a second embodiment of the erfindungsge ^¬ MAESSEN method. This variant embodiment differs from the first embodiment only in that the random key from the second ^¬ bitpermutierten plain data block is not the previous encrypted data block bitpermutierte clear but the previous repermutierte encrypted bitper ^¬ mutated plain data block. In Figure 4 a third embodiment of the method according ^¬ invention is shown. Shown are a separate To ^¬ case reference datum (4.1), a random number (4.2), a key control data (4.3), a permutation (4.4), a Re permutation (4.5), a random key date or more random key data (4.6), EXCLUSIVE-OR Shortcuts (4.7), (4.13), plain data (4.8), memory blocks (4.9), (4.11), (4.14), a bit permutation module (4.10), a switch (4.12), a re-permutation module (4.15) and cipher editors (4.16 ).

The key control data (4.3) are zugsdatum information about the Keyring ^¬ sellängen the applicable key, the key repeat counts, encryption and / or the Ableseort of sepa ^¬ advise random reference data with respect to the global Zufallsbe-.

A key repetition number indicates the number of repeated applications of a key on the plain data. The Permuta ^¬ tion date (4.4) is identical in content to the permutation (2.1) of the first and second embodiment of the invention ^shown SEN method. From the permutation date (4.4), the re-permutation date (4.5) is determined. The separate random ^reference data (4.1) is read from the random ^reference date (not shown) valid for a time range by the encrypting and decrypting module (1.2). The information about the location of the removal of the separate random reference data, to ^¬ number of cases (4.2), the key control data (4.3) and the permutation (4.4) duls (at the location of the encryption in the module (1.2) with a not shown random number generator of the Mo- 1.2) generated. Each at a data encryption used random keys (4.6) is generated from the separate link Zufallsbe ^¬ zugsdatum and at least one 128Bit long random number (4.2) by means of EXCLUSIVE-OR. In this case, the length of the separate random reference datum may be equal to or less than the length of the random number. If the lengths of the sepa- rate randomness datum and the random number in the exclusive-or-join are unequal, the smaller size will be repeated. applying applied. Is all Since ^¬ code encryption key used so generated is greater than the length of the separate random reference data at one of the separate To ^¬ case, the reference date, and at least a random number, a key data the sum of the lengths, the length of the key data is equal to the sum of length of all at a data encryption used key is. Each key used in a data encryption is then taken from the key date depending on the key control date (4.3).

In the case of encryption, the clear data is decomposed into bit blocks. Each bit block is subjected to a bit permutation. The bit-permuted clear data are combined into new variable bit blocks, the length of a variable bit block (4.11) being equal to the key length. The bit-sparse clear bit data of the variable bit block is exclusive-or-linked to the random key selected by the switch (4.12). The results are in bit block (4.14) zwischenge ^¬ stores, subject to re permutation and as Chiffreda- th (4.16) output. Decryption is done like encryption.

Claims

A method for access and communication-related randomization and decryption of data claims 1. A method for access and communication related Zufallsver- and decryption of data characterized in - that at least one encrypting unit blocks to ver ^¬ key the data is subjected to at least one Permutati ^¬ on, wherein at least a portion of the permutation ^¬ data locally at the site of encryption are generated process in a random - in that the encrypting unit blocks with at least one random key to encrypt the data to be encrypted, the locally generated from at least a portion of a globa ^¬ len present in all units random reference data and of at least one of the encryptor unit Random number is formed, - that the encrypting unit, the locally generated permutation data and the locally generated random number or the locally generated random numbers adding in the form of relative data to the encrypted data, - that at least one decrypting unit before Ent ^¬ encryption at the point of decryption, the permutation and the random number, or the random numbers from the relative data back wins with all Zufallsschlüs ^¬ sel be from the existing at the point of decryption global len random reference data and from which recovered from the relative data randomization determined the decrypting unit generates the data to be decrypted block by block with all random keys and with at least one re-permutation and / or permutation keys. 2. Method according to claim 1, characterized that the locally added data are fiddled before being added, wherein the data lichen information is part of the global random access datum, - that the global random reference date is only valid for a period of time and / or - that from the global random reference data spatial data are determined and / or in that the relative data relating to the spatial data and random reference data are determined, wherein a part of the random reference data is a part of the global random reference data and another part is a locally generated random number, and / or that the part of a global randomness datum present in all entities is a separate random datum associated with only the authenticated and authenticated entities, and / or that the encrypting entity informs the decrypting entity of the readout location for the separate random datum in the global random datum and / or - that the message of Ableseortes takes the form of relative Since ^¬ th. 3. The method according to claim 1, characterized - That the data to be encrypted in blocks of predefined length permuted and encrypted bit by bit who ^¬ the random key of the first block of a part of the global random number and a locally generated random number is formed, all other keys of the following blocks from the encrypted Data of the previous block are formed, that a number of encrypted blocks are combined into larger blocks, each subjected to a packet permutation, - that the steps of decryption in reverse Encryption takes place, whereby instead of the permutations Re-permutations and instead of the Re-permutation permutations are made. 4. The method according to claim 3, characterized in that the random keys of all blocks except for the first block are formed by re-permutation of the encrypted data of the previous block or - that as random key of all the blocks following the first block the encrypted data of the preceding one Blockes are used and - That the encrypted with the random keys data is subjected in blocks to a re-permutation. 5. The method according to claim 1, characterized that the data to be encrypted are permuted bit by bit in blocks of predefined length, - that the permuted data is encrypted with at least one random ^¬ key of variable length, - that the encrypted data is repermutiert in the blocks of predefined length, - That the decryption in the same order and with the same operations as the encryption is made. 6. The method according to claim 1, characterized that the data to be encrypted are permuted bit by bit in blocks of predefined length, - wherein a random key in response to at least one Schlüsselwiederholzahl is used repeatedly before the next random ^¬ key is applied to the permuted data is encrypted with more than one random key, that the encrypted data is repermutated in the blocks of the predefined length, - that all key repetition numbers are determined in a random process and in the form of at least one relative date is added to the encrypted data, - That the decryption in the same order and with the same operations as the encryption is made. 7. The method according to claim 1, characterized - That the random encryptions are bitwise exclusive OR operations and / or - that more than one permutation date exist and / or that a permutation date contains a plurality of partial permutation data and each partial permutation date contains a plurality of permutation bytes, - That each Teilpermutationsdatum for a predetermined number of bits of information about the new position in the permuted Block gives and in that the bit location in the permuted block is determined by the location of the permutation byte in the permutation date and the bit location in the non-permuted block by the value of the permutation byte or the bit location in the non-permuted block by the location of the permutation byte in the permutation date and the bit location in the permuted block are determined by the value of the permutation byte. 8. The method according to claim 3, characterized in that the packet permutation data are formed by permutation from the bit permutation data, wherein the values and the position of the permutation bytes in the permutated Permutationsda ^¬ tum the locations of the bit packets in the permuted and not per- mutated Show block. 9. The method according to claim 7 and / or claim 8 characterized that the value of a permutation byte is made by random numbers of numbers from a sequence of predetermined length, distinguishing between valid and invalid draws, - is that in the case of valid contraction of the solid value of the permu ^¬ tationsbyte is not equal to the Ortindex Permutationsbytes of the permutation and the drawn value at the location of the Ortindexes Permutationsbytes transferred to the permutation, in the case of an invalid draw, the dragged value is equal to the location index of the permutation byte in the permutation date and the dragged value is returned to the sequence of numbers. 10. The method according to claims 1 and 2 and / or claim 6 characterized that each random key is formed by bitwise exclusive ORing a separate random reference data and a random number, the separate random reference data being part of a global random global reference data present in all units and / or - That the random number has a predetermined length and / or that the length of the separate random reference datum is equal to or less than or greater than the sum of the lengths of all keys to be used and applied in a data encryption, with larger length not using the excess length of the random datum and at least one of the separate random datum and at least one Random number a key date having a length equal to the sum length of all keys used in a data encryption is determined, and / or - That the key date is formed by exclusive OR link between at least a portion of the separate Zufallsbe ^¬ zugsdatums or the separate random reference date and at least a part of at least one random number, and / or - that each key used in a data encryption is taken from the key date and / or that the lengths of the separate random reference datum and the random number are equal or unequal and / or - that in case of inequality of the lengths in the exclusive-OR operation the smaller size is applied repeatedly and - That at a smaller length of the random number from the random number and at least one further random number is a random date of the length of the separate random reference ge ^¬ forms and / or - That the random date is determined by bitwise exclusive or ORing the random number and at least a part or by more than a part of the further random number and / or - That the separate random reference date and the random number or the random date are considered as location vectors of a predetermined space, the bitwise exclusive-or-linked by coordinates, the extents of the coordinates of the location vectors are determined by the spatial dimensions of the predetermined space and in the case of a smaller extent of a vector coordinate, the coordinate value in the calculation of the exclusive-OR combination is used repetitively or, if the vector coordinate is larger, only the part of the vector coordinate covering the space coordinate of the space is used. 11. A method according to the above claims characterized marked, - that are formed for the formation of the key data or the random numbers used to ^¬ event key and / or random reference data from the random data portion, the strung together the respective random number or the respective random reference data forms, that two consecutive partial random data has at least one Hamming distance of one, - That the length of the Partial Random Date is equal to the length of the data to be encrypted. 12. The method according to claim 1, characterized in that the encryption and decryption of the data in Connection with authentication and authentication ensues that the authentication and authentication required to execute the decryption takes place on the basis of at least one person and / or unit characterizing date and / or address data and / or device data which are added to the encrypted data in the form of relative data.